AutopilotMonitor/rules/schema/gather-rule.schema.json

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/OliverKieselbach/Autopilot-Monitor/main/rules/schema/gather-rule.schema.json",
  "title": "Autopilot Monitor Gather Rule",
  "description": "Defines what data the agent should collect from a Windows device during Autopilot enrollment.",
  "oneOf": [
    { "$ref": "#/$defs/gatherRule" },
    {
      "type": "object",
      "properties": {
        "$schema": { "type": "string" },
        "rules": {
          "type": "array",
          "items": { "$ref": "#/$defs/gatherRule" }
        }
      },
      "required": ["rules"],
      "additionalProperties": false
    }
  ],
  "$defs": {
    "gatherRule": {
      "type": "object",
      "properties": {
        "$schema": {
          "type": "string",
          "description": "JSON Schema reference for editor IntelliSense."
        },
        "ruleId": {
          "type": "string",
          "description": "Unique rule identifier (e.g., \"GATHER-NET-001\").",
          "pattern": "^GATHER-[A-Z]+-\\d{3}$"
        },
        "title": {
          "type": "string",
          "description": "Human-readable rule title (e.g., \"Collect WinHTTP Proxy Settings\")."
        },
        "description": {
          "type": "string",
          "description": "Detailed description of what this rule collects and why."
        },
        "category": {
          "type": "string",
          "description": "Rule category.",
          "enum": ["network", "identity", "apps", "device", "esp", "enrollment"]
        },
        "version": {
          "type": "string",
          "description": "Semantic version of this rule (e.g., \"1.0.0\").",
          "default": "1.0.0"
        },
        "author": {
          "type": "string",
          "description": "Author of this rule.",
          "default": "Autopilot Monitor"
        },
        "enabled": {
          "type": "boolean",
          "description": "Whether this rule is enabled. Set to false to add a rule without activating it immediately.",
          "default": true
        },
        "isCommunity": {
          "type": "boolean",
          "description": "Whether this is a community-contributed rule. Community rules are stored in the global partition alongside built-in rules.",
          "default": false
        },
        "collectorType": {
          "type": "string",
          "description": "Type of data collection.",
          "enum": ["registry", "eventlog", "wmi", "file", "json", "xml", "command_allowlisted", "logparser"]
        },
        "target": {
          "type": "string",
          "description": "Target for collection. Registry path, event log name, WMI query, file path, command string, or log file path depending on collectorType."
        },
        "parameters": {
          "type": "object",
          "description": "Additional parameters for the collector (all values are strings).",
          "additionalProperties": { "type": "string" }
        },
        "trigger": {
          "type": "string",
          "description": "When to collect data. \"phase_change\" fires once when triggerPhase is entered, \"phase_exit\" once when it is left.",
          "enum": ["startup", "phase_change", "phase_exit", "interval", "on_event"]
        },
        "intervalSeconds": {
          "type": "integer",
          "description": "Interval in seconds (only used when trigger = \"interval\").",
          "minimum": 1
        },
        "triggerPhase": {
          "type": "string",
          "description": "Phase to trigger on (used when trigger = \"phase_change\" or \"phase_exit\"). Empty = every phase transition."
        },
        "triggerEventType": {
          "type": "string",
          "description": "Event type to trigger on (only used when trigger = \"on_event\")."
        },
        "activePhases": {
          "type": "array",
          "description": "Run the rule only while the current enrollment phase is one of these phases (EnrollmentPhase enum names). Empty/absent = unrestricted. Mutually exclusive with activeFromPhase.",
          "items": {
            "type": "string",
            "enum": ["Start", "DevicePreparation", "DeviceSetup", "AppsDevice", "AccountSetup", "AppsUser", "FinalizingSetup", "Complete"]
          }
        },
        "activeFromPhase": {
          "type": "string",
          "description": "Activate the rule once the enrollment phase first reaches this phase, then keep it active for the rest of the session (sticky latch). Absent = unrestricted. Mutually exclusive with activePhases.",
          "enum": ["Start", "DevicePreparation", "DeviceSetup", "AppsDevice", "AccountSetup", "AppsUser", "FinalizingSetup", "Complete"]
        },
        "emitMode": {
          "type": "string",
          "description": "Emit behavior: \"always\" (default — emit on every collection) or \"on_change\" (poll on the trigger cadence but emit only when the collected result changes; the first in-scope result always emits).",
          "enum": ["always", "on_change"]
        },
        "enrichErrorCodes": {
          "type": "boolean",
          "description": "Opt-in: let the backend explain error-code fields in this rule's output (exitCode, errorCode, hresult, ...) with the Windows/MSI/Intune error-code catalog, attaching the same *Info siblings built-in events get. Default false because gather-rule codes usually come from third-party logs or commands (HP Image Assistant, Dell Command Update, custom scripts) with their own exit-code numbering, where the catalog meaning would be wrong. Enable only when the parsed source really uses Windows codes (e.g. an msiexec or IME log).",
          "default": false
        },
        "outputEventType": {
          "type": "string",
          "description": "EventType for the emitted event (e.g., \"gather_proxy_settings\")."
        },
        "outputSeverity": {
          "type": "string",
          "description": "Severity for the emitted event.",
          "enum": ["Info", "Warning", "Error", "Critical"],
          "default": "Info"
        },
        "tags": {
          "type": "array",
          "description": "Tags for filtering and categorization.",
          "items": { "type": "string" },
          "default": []
        }
      },
      "required": ["ruleId", "title", "collectorType", "target", "trigger", "outputEventType"],
      "additionalProperties": false
    }
  }
}